OPSEC Fundamentals: A Beginner's Guide to Operational Security

What OPSEC Actually Means

Operational Security — OPSEC — started in military planning, but it applies to anyone who wants real control over what they expose about themselves, online and off. At its core, it's a process for identifying sensitive information, understanding who might want it, and making it harder for them to get it.

Most people treat privacy as a binary: you're either private or you're not. OPSEC reframes that. It's not about hiding everything — it's about making deliberate choices about what you share, with whom, and under what conditions. A journalist protecting a source, a domestic abuse survivor relocating to a new city, and a developer locking down their work network are all practicing OPSEC, just at different levels.

This article walks through the core concepts, gives you a working threat model, and turns abstract principles into habits you can actually use.

---

The Five-Step OPSEC Process

The original OPSEC framework, formalized by the U.S. military in the 1980s, breaks down into five repeatable steps. They work just as well for personal privacy.

Step 1: Identify Your Critical Information

Critical information is anything that, if exposed, would cause harm to you or someone you're protecting. Your home address, your employer, your daily routine, your financial situation, the identities of people you communicate with — all of these qualify.

Write a short list. It forces clarity. Most people discover they've been casually exposing things they'd rather keep private simply because they never stopped to name them as sensitive.

Step 2: Analyze the Threat

A threat is any person or organization that wants your critical information and has some ability to get it. This is where threat modeling becomes essential. Ask yourself: who are my realistic adversaries, what do they actually want, and what tools do they have access to?

Knowing your adversary determines your countermeasures. Defending against data brokers requires completely different steps than defending against a targeted attacker. Conflating the two leads to either over-engineering your defenses or leaving real gaps unaddressed.

Step 3: Analyze Your Vulnerabilities

A vulnerability is any gap between what you want to protect and what you're actually protecting. A few common ones worth recognizing: using the same email address for social media, banking, and newsletters; logging into websites with Google or Facebook (which hands your activity data directly to those platforms); posting location-tagged photos that reveal your home neighborhood; reusing usernames across platforms, which makes OSINT trivially easy for anyone motivated to look.

Step 4: Assess the Risk

Risk sits at the intersection of threat likelihood and impact. Not every vulnerability needs immediate attention — rank them. A low-capability adversary exploiting a low-impact vulnerability is a low-priority item. A high-capability adversary with access to something that could seriously hurt you is urgent.

Step 5: Apply Countermeasures

Countermeasures reduce either the likelihood of exploitation or its impact when it happens. The rest of this article covers the most practical ones.

---

Compartmentalization: The Core Habit

Compartmentalization means separating your identities, activities, and data so that a breach in one area doesn't cascade into everything else. It's the practical version of the "need to know" principle.

A basic strategy: maintain separate email addresses for banking, social accounts, shopping, and newsletters; use different usernames on different platforms with no cross-linking; keep work devices and personal devices separate, especially on shared networks; never use your real name on accounts where anonymity matters.

A more advanced setup uses separate browsers or browser profiles per context. Something like this:

Profile: Banking
  Browser: Firefox (hardened, no extensions except uBlock)
  DNS: Encrypted, no logging

Profile: Social Media
  Browser: Separate Firefox profile
  Never logged into banking here

Profile: Research / Anonymous
  Browser: Tor Browser
  No logins, JavaScript minimized

This sounds tedious until you consider what you're protecting against: one compromised account giving an attacker — or a data broker — a complete picture of your life.

---

Digital Hygiene Basics

Metadata Is the Real Risk

The content of a message is often less revealing than its metadata: who you contacted, when, how frequently, from where. Email providers, messaging apps, and phone carriers all generate metadata. End-to-end encryption protects what you said — it doesn't hide that you said it, or to whom.

Use Signal for sensitive communications. It encrypts content and minimizes metadata exposure compared to SMS. If you run your own mail client, be aware that email headers can reveal your IP address. Strip metadata from photos before sharing them using a tool like exiftool:

# Remove all metadata from an image
exiftool -all= photo.jpg

# Verify metadata has been cleared
exiftool photo.jpg

Reduce Your Attack Surface

Every account you create, every service you sign up for, every app you install is a potential exposure point. Start by deleting unused accounts — JustDeleteMe is a useful starting point for that. Request removal from data broker databases; most major brokers have opt-out processes, though many require repeated follow-up. Consider alias email addresses too. Services like SimpleLogin or AnonAddy let you create per-service aliases that forward to your real inbox, so a breach at one service doesn't expose your actual address.

Passwords and Authentication

Password reuse is one of the most exploited vulnerabilities out there. A credential stuffing attack takes a leaked username and password from one breach and tries it automatically against hundreds of other services. If you've reused a password anywhere, you're exposed.

# Check if your email appears in known breaches
# Using the Have I Been Pwned API (v3)
curl "https://haveibeenpwned.com/api/v3/breachedaccount/[email protected]" \
  -H "hibp-api-key: YOUR_API_KEY"

Use a password manager — Bitwarden is open-source and has been independently audited — with unique, generated passwords for every site. Enable TOTP-based two-factor authentication, not SMS-based. SMS 2FA is vulnerable to SIM-swapping, which is a surprisingly easy attack for a motivated adversary.

---

Physical and Network OPSEC

Network Exposure

Your IP address reveals your approximate location and gets logged by every website you visit. Your ISP sees every unencrypted DNS query you make — essentially a running log of every domain you visit throughout the day.

Basic network hardening starts with switching to an encrypted DNS resolver:

# Check your current DNS resolver
nslookup whoami.akamai.net

# Switch to an encrypted DNS resolver (example: Cloudflare's 1.1.1.1 with DoH)
# On Linux with systemd-resolved, edit /etc/systemd/resolved.conf:
[Resolve]
DNS=1.1.1.1#cloudflare-dns.com
DNSOverTLS=yes

A VPN shifts trust from your ISP to the VPN provider. It doesn't eliminate that trust relationship — it just moves it. For higher-risk scenarios, Tor routes traffic through multiple nodes, preventing any single party from seeing both the source and the destination.

SIM Cards and Mobile Identity

Your phone is one of the most identity-linked devices you carry. Your phone number ties to your real identity through carrier records, gets used for account recovery across dozens of services, and continuously transmits your location to cell towers.

For situations requiring a communications channel not linked to your identity, prepaid SIMs purchased with cash in jurisdictions that don't require ID for activation are the usual approach. The critical detail: the SIM's anonymity is only as strong as the device and behavior surrounding it. Using an anonymous SIM in a phone that's also logged into your Google account defeats the entire purpose. Device, SIM, and behavior have to be compartmentalized together.

Physical Awareness

“Privacy is not something that I'm merely entitled to, it's an absolute prerequisite.”

— Marlon Brando

OPSEC isn't purely digital. Discussing sensitive topics in public spaces or on calls in open areas, leaving your laptop screen visible in a cafe, carrying loyalty cards that build detailed purchase profiles, discarding documents without shredding them — these all expose critical information just as surely as a misconfigured app does. The threat model applies to the physical world too.